CVE-2023-41419: Critical severity Gevent Gevent vulnerability
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
Other sources
An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
Reference: https://github.com/gevent/gevent/issues/1989
Upstream patch: https://github.com/gevent/gevent/commit/2f53c851eaf926767fbac62385615efd4886221c
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/geventto a version that resolves this vulnerability.Fixed in 23.9.0 - Upgrade
Upgrade
redhat/geventto a version that resolves this vulnerability.Fixed in 23.9.1 - Upgrade
Upgrade
geventto a version that resolves this vulnerability.Fixed in 23.9.1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41419?
The severity of CVE-2023-41419 is critical with a CVSS score of 9.8.
How can a remote attacker exploit CVE-2023-41419?
A remote attacker can exploit CVE-2023-41419 by sending a specially crafted script to the WSGIServer component.
Which version of Gevent is affected by CVE-2023-41419?
Versions of Gevent before 23.9.1 are affected by CVE-2023-41419.
How can I fix CVE-2023-41419?
To fix CVE-2023-41419, update Gevent to version 23.9.1 or higher.
Where can I find more information about CVE-2023-41419?
More information about CVE-2023-41419 can be found at the following references: [link1], [link2], [link3].